CVE-2025-21204 exploit simulation for non-admin users via junction-based path hijack.
https://cyberdom.blog/abusing-the-windows-update-stack-to-gain-system-access-cve-2025-21204/
https://raw.githubusercontent.com/eshlomo1/CloudSec/refs/heads/main/Attacking%20the%20Cloud/CVE-2025-21204/Exploit-CVE2025-UpdateStackLPE-NonAdmin.ps1

mssql dumper
https://github.com/LTJAXSON/MSSQL---Dumper

BadSuccessor ports:
Powershell : https://github.com/LuemmelSec/Pentest-Tools-Collection/blob/main/tools/ActiveDirectory/BadSuccessor.ps1
Python: https://github.com/cybrly/badsuccessor
.Net : https://github.com/logangoins/SharpSuccessor

added to
nxc : https://github.com/Pennyw0rth/NetExec
bloodyAD : https://github.com/CravateRouge/bloodyAD

evil-winrm python version
https://github.com/adityatelange/evil-winrm-py

Signature Kid is a header only tool that steals a signature from a file and copy it to whathever file you want.

Beyond Stealing, Signature Kid goes a step further by Windows Internal to trick the system to treat the copied signature as valid.
https://github.com/dslee2022/SignatureKid

BaldHead is a modular and interactive Active Directory (AD) attack framework built for red teamers and security testers. It automates enumeration and exploitation of AD misconfigurations
https://github.com/ahmadallobani/BaldHead

Decrypt SCCM and DPAPI secrets with Powershell.
https://github.com/The-Viper-One/Invoke-PowerDPAPI

This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service.

https://github.com/Wh04m1001/CVE-2025-48799

Client-side Encrypted Upload Server Python Script
https://github.com/vysecurity/ExfilServer

Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
https://github.com/Semperis/GoldenDMSA
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/

CVE-2025-53770 exploit
https://github.com/soltanali0/CVE-2025-53770-Exploit

PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph
https://github.com/SpecterOps/MSSQLHound

TAP SSH VPN - this will allow you to VPN your machine into the remote TAP device through a reverse SSH tunnel.

https://github.com/trustedsec/tap/blob/master/noscripts/ssh-tunnel.sh

Your template-based BloodHound terminal companion tool
https://github.com/fin3ss3g0d/cypherhound

Weaponize DLL hijacking easily. Backdoor any function in any DLL
https://github.com/Print3M/DllShimmer

you can call something like NtAllocateVirtualMemoryEx without ever touching ntdll!

https://github.com/whokilleddb/function-collections/blob/main/winapi_alternatives/NtAllocateMemoryEx/main.c

https://github.com/whokilleddb/hoontr

Group Policy Objects manipulation and exploitation framework
https://github.com/synacktiv/GroupPolicyBackdoor

Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis (such as Code Integrity Policy files).
https://github.com/rasta-mouse/pwnlift

Comprehensive Windows Syscall Extraction & Analysis Framework
https://github.com/xaitax/NTSleuth